Is custom authentication possible without hacking?

Problem/Motivation

My CMIS repository uses a custom header for authentication. I have not found anywhere that I can pass extra options to the HTTP client. All class names seem to be hard coded, so there is not even an option to override service classes. Am I missing how I am expected to do this?

API changes

To be determined.